I recently changed one of my programs to stored procedures for the larger datasets. It sped the program up conciderably, especially at the worksites with slower connections.(these are remote work sites three or four miles from the office where the server is located)
It originally was DAO, then switching to ADO improved it, then the Stored Procedures took it to the next level. The amount of data moving across the wire was reduced conciderably.
Stored procedures sort and filter the data on the server and then send you what you asked for. Running sql statements dirrectly have to run the data back and forth to filter and sort it, that is why it's slower.
I've never heard of Sql injection so I'm going to look at that as well but I've been really happy with what I can do with stored procedures.
A few of my Stored procedures create a temp table in memmory, insert data from different tables as needed, do calculations etc from that table and then send me the new data. Once the stored procedure finishes, it drops the temp table. Very nice feature!